GCHQ’s methods for bulk interception of online communications violated privacy and failed to provide sufficient surveillance safeguards, the European court of human rights has ruled.

But the ECHR found that GCHQ’s regime for sharing sensitive digital intelligence with foreign governments was not illegal, and it explicitly confirmed that bulk interception with tighter safeguards was permissible.

The legal claims, which had already been heard by the UK’s investigatory powers tribunal, were brought by a coalition of 14 human rights groups and privacy organisations including Amnesty International, Liberty, Privacy International and Big Brother Watch, as well as journalists.

The case concerned the interception regime previously operated by GCHQ. Updated regulations are coming into force under the Investigatory Powers Act 2016. The ECHR did not examine this legislation, which already faces fresh legal challenges.

The judges considered three aspects of digital surveillance: bulk interception of communications, intelligence sharing, and obtaining communications data from service providers.

By a majority of five to two votes, the Strasbourg judges found that GCHQ’s bulk interception regime violated article 8 of the European convention on human rights, which guarantees privacy, because there were said to be insufficient safeguards, and rules governing the selection of “related communications data” were deemed to be inadequate.

The regime used by the UK government for sharing intelligence with foreign governments did not violate either article 8 or article 10, which guarantees freedom of speech. Not was there any evidence, the judges said, to suggest that the intelligence services were abusing their powers.

The legal challenge was triggered by revelations made by Snowden in 2013, which showed GCHQ was secretly intercepting, processing and storing data about millions of people’s private communications, even when those people were of no intelligence interest. In one of the operations, called Tempora, the eavesdropping agency tapped into cables and communication networks to obtain huge volumes of internet data.

Snowden praised the judgment, saying governments had been pursued through the courts for five years. “Today, we won,” he tweeted.

Edward Snowden (@Snowden)

For five long years, governments have denied that global mass surveillance violates of your rights. And for five long years, we have chased them through the doors of every court. Today, we won. Don't thank me: thank all of those who never stopped fighting. https://t.co/ARgbI5PKaa

In accompanying notes to the main judgment, which runs to more than 500 paragraphs, the court said it recognised the severity of the threats of terrorism, online sexual abuse and other crimes faced by European states. Advancements in technology had made it easier for terrorists and criminals to evade detection on the internet, the judges acknowledged.

Bulk interception regimes can be legal if countries deem them to be necessary in the interests of national security but certain minimum safeguards are required.

Those safeguards include that the law must indicate “the nature of offences which may give rise to an interception order; a definition of the categories of people liable to have their communications intercepted; a limit on the duration of interception; the procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when communicating the data to other parties; and the circumstances in which intercepted data may or must be erased or destroyed.”

The judgment was critical of interception warrants obtained under section 8(4) of the Regulation of Investigatory Powers Act. Such warrants do not need to name or describe the person subject to interception or the premises involved.

The judges added: “It would be wrong automatically to assume that bulk interception constitutes a greater intrusion into the private life of an individual than targeted interception, which by its very nature is more likely to result in the acquisition and examination of a large volume of his or her communications.”

A government spokesperson said: “The Investigatory Powers Act 2016 replaced large parts of the Regulation of Investigatory Powers Act which was the subject of this challenge.

“This includes the introduction of a ‘double lock’ which requires warrants for the use of these powers to be authorised by a secretary of state and approved by a judge. An investigatory powers commissioner has also been created to ensure robust independent oversight of how these powers are used. The government will give careful consideration to the court’s findings.”

Megan Goulding, a lawyer for Liberty, said: “This is a major victory for the rights and freedom of people in the UK. It shows that there is – and should be – a limit to the extent that states can spy on their citizens.”

Lucy Claridge, of Amnesty International, said: “Today’s ruling represents a significant step forward in the protection of privacy and freedom of expression worldwide. It sends a strong message to the UK government that its use of extensive surveillance powers is abusive and runs against the very principles that it claims to be defending.”

Dan Carey, of Deighton Pierce Glynn, who represented some of applicants, said: “The court has put down a marker that the UK government does not have a free hand with the public’s communications and that in several key respects the UK’s laws and surveillance practices have failed. In particular, there needs to be much greater control over the search terms that the government is using to sift our communications.”

Jim Killock, the executive director of Open Rights Group, said: “Since we brought this case in 2013, the UK has actually increased its powers to indiscriminately surveil our communications whether or not we are suspected of any criminal activity. ”

Rachel Oldroyd, of the Bureau of Investigative Journalism, which raised free speech concerns, said: “The freedom of the press is a vital cornerstone of democracy and journalists must be able to protect their sources. We are particularly concerned about the chilling effect that the threat of state surveillance has on whistleblowers who want to expose wrongdoing, and this ruling will force our government to put safeguards in place.”